CVE-2025-43992 — Geo Replication. An Unauthenticated Attacker With Remote Acc Authentication Bypass

title: Unauthenticated Geo Replication Access Attempt — CVE-2025-43992
id: scw-2026-05-11-ai-1
status: experimental
level: critical
description: |
  Detects attempts to access the Geo Replication status endpoint without authentication, which is the core of the authentication bypass vulnerability in Dell ECS and ObjectScale. This indicates an attacker attempting to exploit CVE-2025-43992 for unauthorized access.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-43992/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/geo-replication/status'
      cs-method:
          - 'GET'
      sc-status:
          - '200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse